Front-End Web Application Security

🔑 Key Takeaway: A compromised frontend can silently route wallets to attacker contracts. Treat web and mobile clients as high-value control planes, not cosmetic packaging.

Front-end and mobile surfaces of Web3 protocols are often overlooked relative to on-chain review. If a client is compromised—injected scripts, swapped destinations, malicious dependencies—users can interact with attacker-controlled contracts or leak session power without any smart-contract bug.

This framework covers baseline web app practices, third-party script controls (CSP/SRI and related), mobile notes, common vulnerability classes, and catalogues of tools.

What this framework covers

1. Web Application Security: frameworks, OWASP-oriented defects, hosting lock-down, availability patterns.
2. Third-Party Script Security: CSP, SRI, Trusted Types, and incident lessons for script supply chain.
3. Mobile Application Security: mobile client controls for Web3 apps.
4. Common Vulnerabilities: ATO, XSS, CSRF, IDOR, and related classes.
5. Security Tools and Resources: scanners and curated tool lists.

Related frameworks

• Supply Chain: dependency and frontend delivery integrity
• ENS: name resolution integrity when clients display or resolve names
• Infrastructure: hosting, DNS, CDN, DDoS
• Wallet Security: wallet UX and signing confirmation boundaries
• Secure Software Development: reviews and coding standards
• Security Testing: dynamic and static test methods

Further Reading

• OWASP Top Ten
• OWASP Application Security Verification Standard
• MDN — Content Security Policy